@aiclude/security-skill 0.1.0 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SKILL.md +38 -25
- package/package.json +1 -1
package/SKILL.md
CHANGED
|
@@ -1,57 +1,70 @@
|
|
|
1
1
|
# /security-scan - AIclude Security Vulnerability Scanner
|
|
2
2
|
|
|
3
|
-
AI Agent
|
|
4
|
-
기존 스캔 결과가 있으면 즉시 반환하고, 없으면 새로 등록하여 스캔을 수행합니다.
|
|
3
|
+
Scan MCP Servers and AI Agent Skills for security vulnerabilities. Returns existing scan results instantly if available, or registers the target and triggers a new scan automatically.
|
|
5
4
|
|
|
6
5
|
## Usage
|
|
7
6
|
|
|
8
7
|
```
|
|
9
|
-
#
|
|
8
|
+
# Search by name (recommended - leverages existing scan results)
|
|
10
9
|
/security-scan --name <package-name> [options]
|
|
11
10
|
|
|
12
|
-
#
|
|
11
|
+
# Scan a local directory directly
|
|
13
12
|
/security-scan <target-path> [options]
|
|
14
13
|
```
|
|
15
14
|
|
|
16
15
|
## Parameters
|
|
17
16
|
|
|
18
|
-
- `--name`:
|
|
19
|
-
- `target-path`:
|
|
20
|
-
- `--type`:
|
|
21
|
-
- `--profile`:
|
|
22
|
-
- `--format`:
|
|
23
|
-
- `--engines`:
|
|
17
|
+
- `--name`: Name of the MCP server or Skill to search (npm package name, GitHub repo, etc.)
|
|
18
|
+
- `target-path`: Local path to scan (use instead of --name)
|
|
19
|
+
- `--type`: Target type (`mcp-server` | `skill`) - auto-detected if omitted
|
|
20
|
+
- `--profile`: Sandbox isolation profile (`strict` | `standard` | `permissive`)
|
|
21
|
+
- `--format`: Report output format (`markdown` | `json`)
|
|
22
|
+
- `--engines`: Scan engines to use (comma-separated)
|
|
24
23
|
|
|
25
24
|
## Examples
|
|
26
25
|
|
|
27
26
|
```
|
|
28
|
-
#
|
|
27
|
+
# Search security scan results for an MCP server
|
|
29
28
|
/security-scan --name @anthropic/mcp-server-fetch
|
|
30
29
|
|
|
31
|
-
#
|
|
30
|
+
# Search scan results for a Skill
|
|
32
31
|
/security-scan --name my-awesome-skill --type skill
|
|
33
32
|
|
|
34
|
-
#
|
|
33
|
+
# Scan local source code
|
|
35
34
|
/security-scan ./my-mcp-server
|
|
36
35
|
```
|
|
37
36
|
|
|
38
37
|
## What It Checks
|
|
39
38
|
|
|
40
|
-
- **Prompt Injection**:
|
|
41
|
-
- **Tool Poisoning**:
|
|
42
|
-
- **Command Injection**: exec/spawn
|
|
43
|
-
- **Supply Chain**:
|
|
44
|
-
- **Malware**:
|
|
45
|
-
- **Permission Abuse**:
|
|
39
|
+
- **Prompt Injection**: Hidden prompt injection patterns targeting LLMs
|
|
40
|
+
- **Tool Poisoning**: Malicious instructions embedded in tool descriptions
|
|
41
|
+
- **Command Injection**: Unvalidated input passed to exec/spawn calls
|
|
42
|
+
- **Supply Chain**: Known CVEs in dependencies and malicious packages (typosquatting)
|
|
43
|
+
- **Malware**: Backdoors, cryptominers, ransomware, data stealers, and obfuscated code
|
|
44
|
+
- **Permission Abuse**: Excessive filesystem, network, or process permissions
|
|
45
|
+
|
|
46
|
+
## Scan Engines
|
|
47
|
+
|
|
48
|
+
7 engines run in parallel for comprehensive coverage:
|
|
49
|
+
|
|
50
|
+
| Engine | Description |
|
|
51
|
+
|--------|-------------|
|
|
52
|
+
| SAST | Static code pattern matching against YAML rule sets |
|
|
53
|
+
| SCA | Dependency CVE lookup via OSV.dev, SBOM generation |
|
|
54
|
+
| Tool Analyzer | MCP tool definition analysis (poisoning, shadowing, rug-pull) |
|
|
55
|
+
| DAST | Parameter fuzzing (SQL/Command/XSS injection) |
|
|
56
|
+
| Permission Checker | Filesystem, network, and process permission analysis |
|
|
57
|
+
| Behavior Monitor | Runtime behavior pattern detection |
|
|
58
|
+
| Malware Detector | Signature scanning, entropy analysis, backdoor detection |
|
|
46
59
|
|
|
47
60
|
## Output
|
|
48
61
|
|
|
49
|
-
|
|
50
|
-
1.
|
|
51
|
-
2.
|
|
52
|
-
3.
|
|
53
|
-
4.
|
|
62
|
+
The report includes:
|
|
63
|
+
1. **Risk Level Summary** (CRITICAL / HIGH / MEDIUM / LOW / INFO)
|
|
64
|
+
2. **Vulnerability List** (code location, description, severity)
|
|
65
|
+
3. **Risk Assessment** (what risks are present and their impact)
|
|
66
|
+
4. **Remediation Recommendations** (how to fix each vulnerability)
|
|
54
67
|
|
|
55
68
|
## Web Dashboard
|
|
56
69
|
|
|
57
|
-
|
|
70
|
+
View all scan results at https://vs.aiclude.com
|
package/package.json
CHANGED